GitLab: Send arbitrary PUT requests when user clicks on a link

Dear teams, Summary Mermaid allows users to set class name of a block. This ability becomes vulnerable in Gitlab issues because of issue.jsL90: javascript return $document.on 'click', '.js-issuable-actions a.btn-close, .js-issuable-actions a.btn-reopen', e = ... const $button = $e.currentTarget;...

Apple iOS webkit memory corruption vulnerability (CNVD-2017-05606)

Apple iOS is an operating system for Apple smart devices. A memory corruption vulnerability exists in Webkit used by Apple iOS, which allows attackers to exploit the vulnerability to build malicious web pages that can be clicked on by users, which can crash the application or execute arbitrary co...

Mozilla Firefox - Proxy Prototype Privileged JavaScript Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/exploitation/jsobfu' class Metasploit3 'Firefox Proxy Prototype Privileged Javascript Injection', 'Description' = %q This exploit gains...

Cock wire from scratch-micro-shoot APP vulnerability-vulnerability warning-the black bar safety net

Micro-shot, is the mobile Internet the most popular mobile video social APP, has a unique whitening Skin Beauty and other video effects in iPhone and Android Phones the App Store social category and the photography category of the APP list are among the best in Beijing grasshopper online Technolo...